Browse CVEs by Ecosystem and Severity

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

Steeltoe's static JWKS cache shared across schemes and never invalidated

Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

ImageMagick: Memory Leak in wand option parser when providing invalid arguments

Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)

Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx

ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments

ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails

ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop

ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition

ImageMagick: Policy Bypass can read disallowed files via symlink

ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems

ImageMagick Vulnerable to Stack Overflow in its MVG Decoder

ImageMagick has an Infinite Loop in subimage-search with crafted image

ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

CoreWCF: SAML token replay protection is inoperative

CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

CoreWCF: WS-Security signature substitution via document-wide Signature lookup

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation

Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking